

<!DOCTYPE html>
<html class="writer-html5" lang="en" >
<head>
  <meta charset="utf-8" />
  
  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
  
  <title>认证和访问控制列表 &mdash; Ceph Documentation</title>
  

  
  <link rel="stylesheet" href="../../../_static/ceph.css" type="text/css" />
  <link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
  <link rel="stylesheet" href="../../../_static/graphviz.css" type="text/css" />
  <link rel="stylesheet" href="../../../_static/css/custom.css" type="text/css" />

  
  
    <link rel="shortcut icon" href="../../../_static/favicon.ico"/>
  

  
  

  

  
  <!--[if lt IE 9]>
    <script src="../../../_static/js/html5shiv.min.js"></script>
  <![endif]-->
  
    
      <script type="text/javascript" id="documentation_options" data-url_root="../../../" src="../../../_static/documentation_options.js"></script>
        <script src="../../../_static/jquery.js"></script>
        <script src="../../../_static/underscore.js"></script>
        <script src="../../../_static/doctools.js"></script>
    
    <script type="text/javascript" src="../../../_static/js/theme.js"></script>

    
    <link rel="index" title="Index" href="../../../genindex/" />
    <link rel="search" title="Search" href="../../../search/" />
    <link rel="next" title="服务支持的操作" href="../serviceops/" />
    <link rel="prev" title="常见问题" href="../commons/" /> 
</head>

<body class="wy-body-for-nav">

   
  <header class="top-bar">
    

















<div role="navigation" aria-label="breadcrumbs navigation">

  <ul class="wy-breadcrumbs">
    
      <li><a href="../../../" class="icon icon-home"></a> &raquo;</li>
        
          <li><a href="../../">Ceph 对象网关</a> &raquo;</li>
        
          <li><a href="../">Ceph 对象网关的 S3 API</a> &raquo;</li>
        
      <li>认证和访问控制列表</li>
    
    
      <li class="wy-breadcrumbs-aside">
        
          
            <a href="../../../_sources/radosgw/s3/authentication.rst.txt" rel="nofollow"> View page source</a>
          
        
      </li>
    
  </ul>

  
  <hr/>
</div>
  </header>
  <div class="wy-grid-for-nav">
    
    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
      <div class="wy-side-scroll">
        <div class="wy-side-nav-search"  style="background: #eee" >
          

          
            <a href="../../../">
          

          
            
            <img src="../../../_static/logo.png" class="logo" alt="Logo"/>
          
          </a>

          

          
<div role="search">
  <form id="rtd-search-form" class="wy-form" action="../../../search/" method="get">
    <input type="text" name="q" placeholder="Search docs" />
    <input type="hidden" name="check_keywords" value="yes" />
    <input type="hidden" name="area" value="default" />
  </form>
</div>

          
        </div>

        
        <div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="main navigation">
          
            
            
              
            
            
              <ul class="current">
<li class="toctree-l1"><a class="reference internal" href="../../../start/intro/">Ceph 简介</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../install/">安装 Ceph</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../cephadm/">Cephadm</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../rados/">Ceph 存储集群</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../cephfs/">Ceph 文件系统</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../rbd/">Ceph 块设备</a></li>
<li class="toctree-l1 current"><a class="reference internal" href="../../">Ceph 对象网关</a><ul class="current">
<li class="toctree-l2"><a class="reference internal" href="../../frontends/">HTTP 前端</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../placement/">存储池归置与存储类</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../multisite/">多站配置</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../multisite-sync-policy/">多站同步策略配置</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../pools/">存储池的配置</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../config-ref/">配置参考</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../admin/">管理指南</a></li>
<li class="toctree-l2 current"><a class="reference internal" href="../">S3 API</a><ul class="current">
<li class="toctree-l3 current"><a class="reference internal" href="../#api">API</a><ul class="current">
<li class="toctree-l4"><a class="reference internal" href="../commons/">常见的</a></li>
<li class="toctree-l4 current"><a class="current reference internal" href="#">认证</a></li>
<li class="toctree-l4"><a class="reference internal" href="../serviceops/">Service Ops</a></li>
<li class="toctree-l4"><a class="reference internal" href="../bucketops/">Bucket Ops</a></li>
<li class="toctree-l4"><a class="reference internal" href="../objectops/">Object Ops</a></li>
<li class="toctree-l4"><a class="reference internal" href="../cpp/">C++</a></li>
<li class="toctree-l4"><a class="reference internal" href="../csharp/">C#</a></li>
<li class="toctree-l4"><a class="reference internal" href="../java/">Java</a></li>
<li class="toctree-l4"><a class="reference internal" href="../perl/">Perl</a></li>
<li class="toctree-l4"><a class="reference internal" href="../php/">PHP</a></li>
<li class="toctree-l4"><a class="reference internal" href="../python/">Python</a></li>
<li class="toctree-l4"><a class="reference internal" href="../ruby/">Ruby AWS::SDK Examples (aws-sdk gem ~&gt;2)</a></li>
<li class="toctree-l4"><a class="reference internal" href="../ruby/#ruby-aws-s3-examples-aws-s3-gem">Ruby AWS::S3 Examples (aws-s3 gem)</a></li>
</ul>
</li>
<li class="toctree-l3"><a class="reference internal" href="../#id1">功能支持情况</a></li>
<li class="toctree-l3"><a class="reference internal" href="../#header">不支持的 Header 字段</a></li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="../../rgw-cache/">Data caching and CDN</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../swift/">Swift API</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../adminops/">管理操作 API</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../api/">Python 接口</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../nfs/">通过 NFS 导出</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../keystone/">与 OpenStack Keystone 对接</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../barbican/">与 OpenStack Barbican 对接</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../vault/">与 HashiCorp Vault 对接</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../kmip/">KMIP Integration</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../opa/">与 Open Policy Agent 对接</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../multitenancy/">多租户</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../compression/">压缩</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../ldap-auth/">LDAP 认证</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../encryption/">服务器端加密</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../bucketpolicy/">桶策略</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../dynamicresharding/">动态的桶索引重分片</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../mfa/">多因子认证</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../sync-modules/">同步模块</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../notifications/">Bucket Notifications</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../layout/">RADOS 中的数据布局</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../STS/">STS</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../STSLite/">STS Lite</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../keycloak/">Keycloak</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../role/">Role</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../session-tags/">Session Tags</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../orphans/">Orphan List and Associated Tooliing</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../oidc/">OpenID Connect Provider</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../troubleshooting/">故障排除</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../../man/8/radosgw/">radosgw 手册页</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../../man/8/radosgw-admin/">radosgw-admin 手册页</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../qat-accel/">使用 QAT 为加密和压缩提速</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../s3select/">S3-select</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../lua-scripting/">Lua Scripting</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../d3n_datacache/">D3N Data Cache</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../cloud-transition/">Cloud Transition</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../../../mgr/">Ceph 管理器守护进程</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../mgr/dashboard/">Ceph 仪表盘</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../api/">API 文档</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../architecture/">体系结构</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../dev/developer_guide/">开发者指南</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../dev/internals/">Ceph 内幕</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../governance/">项目管理</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../foundation/">Ceph 基金会</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../ceph-volume/">ceph-volume</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../releases/general/">Ceph 版本（总目录）</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../releases/">Ceph 版本（索引）</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../security/">Security</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../glossary/">Ceph 术语</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../jaegertracing/">Tracing</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../translation_cn/">中文版翻译资源</a></li>
</ul>

            
          
        </div>
        
      </div>
    </nav>

    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap">

      
      <nav class="wy-nav-top" aria-label="top navigation">
        
          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
          <a href="../../../">Ceph</a>
        
      </nav>


      <div class="wy-nav-content">
        
        <div class="rst-content">
        
          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
           <div itemprop="articleBody">
            
<div id="dev-warning" class="admonition note">
  <p class="first admonition-title">Notice</p>
  <p class="last">This document is for a development version of Ceph.</p>
</div>
  <div id="docubetter" align="right" style="padding: 5px; font-weight: bold;">
    <a href="https://pad.ceph.com/p/Report_Documentation_Bugs">Report a Documentation Bug</a>
  </div>

  
  <div class="section" id="id1">
<h1>认证和访问控制列表<a class="headerlink" href="#id1" title="Permalink to this headline">¶</a></h1>
<p>Requests to the RADOS Gateway (RGW) can be either authenticated or
unauthenticated. RGW assumes unauthenticated requests are sent by an anonymous
user. RGW supports canned ACLs.</p>
<div class="section" id="id2">
<h2>认证<a class="headerlink" href="#id2" title="Permalink to this headline">¶</a></h2>
<p>Authenticating a request requires including an access key and a Hash-based
Message Authentication Code (HMAC) in the request before it is sent to the
RGW server. RGW uses an S3-compatible authentication approach.</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">HTTP</span><span class="o">/</span><span class="mf">1.1</span>
<span class="n">PUT</span> <span class="o">/</span><span class="n">buckets</span><span class="o">/</span><span class="n">bucket</span><span class="o">/</span><span class="nb">object</span><span class="o">.</span><span class="n">mpeg</span>
<span class="n">Host</span><span class="p">:</span> <span class="n">cname</span><span class="o">.</span><span class="n">domain</span><span class="o">.</span><span class="n">com</span>
<span class="n">Date</span><span class="p">:</span> <span class="n">Mon</span><span class="p">,</span> <span class="mi">2</span> <span class="n">Jan</span> <span class="mi">2012</span> <span class="mi">00</span><span class="p">:</span><span class="mi">01</span><span class="p">:</span><span class="mi">01</span> <span class="o">+</span><span class="mi">0000</span>
<span class="n">Content</span><span class="o">-</span><span class="n">Encoding</span><span class="p">:</span> <span class="n">mpeg</span>
<span class="n">Content</span><span class="o">-</span><span class="n">Length</span><span class="p">:</span> <span class="mi">9999999</span>

<span class="n">Authorization</span><span class="p">:</span> <span class="n">AWS</span> <span class="p">{</span><span class="n">access</span><span class="o">-</span><span class="n">key</span><span class="p">}:{</span><span class="nb">hash</span><span class="o">-</span><span class="n">of</span><span class="o">-</span><span class="n">header</span><span class="o">-</span><span class="ow">and</span><span class="o">-</span><span class="n">secret</span><span class="p">}</span>
</pre></div>
</div>
<p>In the foregoing example, replace <code class="docutils literal notranslate"><span class="pre">{access-key}</span></code> with the value for your access
key ID followed by a colon (<code class="docutils literal notranslate"><span class="pre">:</span></code>). Replace <code class="docutils literal notranslate"><span class="pre">{hash-of-header-and-secret}</span></code> with
a hash of the header string and the secret corresponding to the access key ID.</p>
<p>To generate the hash of the header string and secret, you must:</p>
<ol class="arabic simple">
<li><p>Get the value of the header string.</p></li>
<li><p>Normalize the request header string into canonical form.</p></li>
<li><p>Generate an HMAC using a SHA-1 hashing algorithm.
See <a class="reference external" href="http://www.ietf.org/rfc/rfc2104.txt">RFC 2104</a> and <a class="reference external" href="https://en.wikipedia.org/wiki/HMAC">HMAC</a> for details.</p></li>
<li><p>Encode the <code class="docutils literal notranslate"><span class="pre">hmac</span></code> result as base-64.</p></li>
</ol>
<p>To normalize the header into canonical form:</p>
<ol class="arabic simple">
<li><p>Get all fields beginning with <code class="docutils literal notranslate"><span class="pre">x-amz-</span></code>.</p></li>
<li><p>Ensure that the fields are all lowercase.</p></li>
<li><p>Sort the fields lexicographically.</p></li>
<li><p>Combine multiple instances of the same field name into a
single field and separate the field values with a comma.</p></li>
<li><p>Replace white space and line breaks in field values with a single space.</p></li>
<li><p>Remove white space before and after colons.</p></li>
<li><p>Append a new line after each field.</p></li>
<li><p>Merge the fields back into the header.</p></li>
</ol>
<p>Replace the <code class="docutils literal notranslate"><span class="pre">{hash-of-header-and-secret}</span></code> with the base-64 encoded HMAC string.</p>
</div>
<div class="section" id="openstack-keystone">
<h2>向 OpenStack Keystone 发起认证<a class="headerlink" href="#openstack-keystone" title="Permalink to this headline">¶</a></h2>
<p>In a radosgw instance that is configured with authentication against
OpenStack Keystone, it is possible to use Keystone as an authoritative
source for S3 API authentication. To do so, you must set:</p>
<ul class="simple">
<li><p>the <code class="docutils literal notranslate"><span class="pre">rgw</span> <span class="pre">keystone</span></code> configuration options explained in <a class="reference internal" href="../../keystone/"><span class="doc">与 OpenStack Keystone 对接</span></a>,</p></li>
<li><p><code class="docutils literal notranslate"><span class="pre">rgw</span> <span class="pre">s3</span> <span class="pre">auth</span> <span class="pre">use</span> <span class="pre">keystone</span> <span class="pre">=</span> <span class="pre">true</span></code>.</p></li>
</ul>
<p>In addition, a user wishing to use the S3 API must obtain an AWS-style
access key and secret key. They can do so with the <code class="docutils literal notranslate"><span class="pre">openstack</span> <span class="pre">ec2</span>
<span class="pre">credentials</span> <span class="pre">create</span></code> command:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ openstack --os-interface public ec2 credentials create
+------------+---------------------------------------------------------------------------------------------------------------------------------------------+
| Field      | Value                                                                                                                                       |
+------------+---------------------------------------------------------------------------------------------------------------------------------------------+
| access     | c921676aaabbccdeadbeef7e8b0eeb2c                                                                                                            |
| links      | {u&#39;self&#39;: u&#39;https://auth.example.com:5000/v3/users/7ecbebaffeabbddeadbeefa23267ccbb24/credentials/OS-EC2/c921676aaabbccdeadbeef7e8b0eeb2c&#39;} |
| project_id | 5ed51981aab4679851adeadbeef6ebf7                                                                                                            |
| secret     | ********************************                                                                                                            |
| trust_id   | None                                                                                                                                        |
| user_id    | 7ecbebaffeabbddeadbeefa23267cc24                                                                                                            |
+------------+---------------------------------------------------------------------------------------------------------------------------------------------+
</pre></div>
</div>
<p>那样生成的访问密钥和私钥稍后可以用来访问 S3 API 的 radosgw 。</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>Consider that most production radosgw deployments
authenticating against OpenStack Keystone are also set up
for <a class="reference internal" href="../../multitenancy/"><span class="doc">RGW 多租户</span></a>, for which special
considerations apply with respect to S3 signed URLs and
public read ACLs.</p>
</div>
</div>
<div class="section" id="acl">
<h2>访问控制列表（ ACL ）<a class="headerlink" href="#acl" title="Permalink to this headline">¶</a></h2>
<p>RGW supports S3-compatible ACL functionality. An ACL is a list of access grants
that specify which operations a user can perform on a bucket or on an object.
Each grant has a different meaning when applied to a bucket versus applied to
an object:</p>
<table class="docutils align-default">
<colgroup>
<col style="width: 15%" />
<col style="width: 47%" />
<col style="width: 38%" />
</colgroup>
<thead>
<tr class="row-odd"><th class="head"><p>Permission</p></th>
<th class="head"><p>Bucket</p></th>
<th class="head"><p>Object</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">READ</span></code></p></td>
<td><p>Grantee can list the objects in the bucket.</p></td>
<td><p>Grantee can read the object.</p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">WRITE</span></code></p></td>
<td><p>Grantee can write or delete objects in the bucket.</p></td>
<td><p>N/A</p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">READ_ACP</span></code></p></td>
<td><p>Grantee can read bucket ACL.</p></td>
<td><p>Grantee can read the object ACL.</p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">WRITE_ACP</span></code></p></td>
<td><p>Grantee can write bucket ACL.</p></td>
<td><p>Grantee can write to the object ACL.</p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">FULL_CONTROL</span></code></p></td>
<td><p>Grantee has full permissions for object in the bucket.</p></td>
<td><p>Grantee can read or write to the object ACL.</p></td>
</tr>
</tbody>
</table>
<p>Internally, S3 operations are mapped to ACL permissions thus:</p>
<table class="docutils align-default">
<colgroup>
<col style="width: 72%" />
<col style="width: 28%" />
</colgroup>
<thead>
<tr class="row-odd"><th class="head"><p>Operation</p></th>
<th class="head"><p>Permission</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetObject</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetObjectTorrent</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetObjectVersion</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetObjectVersionTorrent</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetObjectTagging</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetObjectVersionTagging</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:ListAllMyBuckets</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:ListBucket</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:ListBucketMultipartUploads</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:ListBucketVersions</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:ListMultipartUploadParts</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:AbortMultipartUpload</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:CreateBucket</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:DeleteBucket</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:DeleteObject</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:s3DeleteObjectVersion</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:PutObject</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:PutObjectTagging</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:PutObjectVersionTagging</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:DeleteObjectTagging</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:DeleteObjectVersionTagging</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:RestoreObject</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetAccelerateConfiguration</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ_ACP</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetBucketAcl</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ_ACP</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetBucketCORS</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ_ACP</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetBucketLocation</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ_ACP</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetBucketLogging</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ_ACP</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetBucketNotification</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ_ACP</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetBucketPolicy</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ_ACP</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetBucketRequestPayment</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ_ACP</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetBucketTagging</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ_ACP</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetBucketVersioning</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ_ACP</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetBucketWebsite</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ_ACP</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetLifecycleConfiguration</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ_ACP</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetObjectAcl</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ_ACP</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetObjectVersionAcl</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ_ACP</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetReplicationConfiguration</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ_ACP</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:GetBucketEncryption</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">READ_ACP</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:DeleteBucketPolicy</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE_ACP</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:DeleteBucketWebsite</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE_ACP</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:DeleteReplicationConfiguration</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE_ACP</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:PutAccelerateConfiguration</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE_ACP</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:PutBucketAcl</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE_ACP</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:PutBucketCORS</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE_ACP</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:PutBucketLogging</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE_ACP</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:PutBucketNotification</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE_ACP</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:PutBucketPolicy</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE_ACP</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:PutBucketRequestPayment</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE_ACP</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:PutBucketTagging</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE_ACP</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:PutPutBucketVersioning</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE_ACP</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:PutBucketWebsite</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE_ACP</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:PutLifecycleConfiguration</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE_ACP</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:PutObjectAcl</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE_ACP</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:PutObjectVersionAcl</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE_ACP</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">s3:PutReplicationConfiguration</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE_ACP</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">s3:PutBucketEncryption</span></code></p></td>
<td><p><code class="docutils literal notranslate"><span class="pre">WRITE_ACP</span></code></p></td>
</tr>
</tbody>
</table>
<p>Some mappings, (e.g. <code class="docutils literal notranslate"><span class="pre">s3:CreateBucket</span></code> to <code class="docutils literal notranslate"><span class="pre">WRITE</span></code>) are not
applicable to S3 operation, but are required to allow Swift and S3 to
access the same resources when things like Swift user ACLs are in
play. This is one of the many reasons that you should use S3 bucket
policies rather than S3 ACLs when possible.</p>
</div>
</div>



           </div>
           
          </div>
          <footer>
    <div class="rst-footer-buttons" role="navigation" aria-label="footer navigation">
        <a href="../serviceops/" class="btn btn-neutral float-right" title="服务支持的操作" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
        <a href="../commons/" class="btn btn-neutral float-left" title="常见问题" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
    </div>

  <hr/>

  <div role="contentinfo">
    <p>
        &#169; Copyright 2016, Ceph authors and contributors. Licensed under Creative Commons Attribution Share Alike 3.0 (CC-BY-SA-3.0).

    </p>
  </div> 

</footer>
        </div>
      </div>

    </section>

  </div>
  

  <script type="text/javascript">
      jQuery(function () {
          SphinxRtdTheme.Navigation.enable(true);
      });
  </script>

  
  
    
   

</body>
</html>